Techniques
Sample rules
Invalid PIM License
- source: sigma
- technicques:
- t1078
Description
Identifies when an organization doesn’t have the proper license for PIM and is out of compliance.
Detection logic
condition: selection
selection:
riskEventType: invalidLicenseAlertIncident